O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

8.18. Create an Extranet with Mutual PAT

Problem

You want to resolve an IP address clash within an extranet by translating both sides to a neutral address space.

Solution

Configure policy NAT-SRC for the outbound traffic. Both clients and servers are source-port address-translated:

	set interface ethernet0/0 ext ip 1.1.1.200 255.255.255.255 dip 4 1.1.1.200
	set interface ethernet0/1 ext ip 1.1.1.100 255.255.255.255 dip 5 1.1.1.100

Then, configure policy NAT-DST to make servers available to clients:

	set address "Inside" "1.1.1.1/32" 1.1.1.1 255.255.255.255 "Public server left"
	set address "Inside" "192.168.1.0/24" 192.168.1.0 255.255.255.0 "Left network"
	set address "Outside" "1.1.1.2/32" 1.1.1.2 255.255.255.255 "Public server right"
	set address "Outside" "192.168.2.0/24" 192.168.2.0 255.255.255.0 "Right network"

Finally, configure the policies:

	set policy id 1 from "Inside" to "Outside" "192.168.1.0/24"
	"1.1.1.2/32" "ANY" nat src dip-id 5 dst ip 192.168.2.100 permit log
	set policy id 2 from "Outside" to "Inside" "192.168.2.0/24"
	"1.1.1.1/32" "ANY" nat src dip-id 4 dst ip 192.168.1.100 permit log

All of the originating addresses from either side will be hidden behind one port-address translated address. All of the destinations will be one-to-one statically translated.

Discussion

This recipe assumes the topology shown in Figure 8-4; that is, you want to connect to a partner network, but neither of your internal address spaces is routable at either side (perhaps because both use the same IP ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required